Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 22:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe
- Size 4.9MB
- Sample260924-2e37psysav
- SHA256 6f21b609ec46ec04b046bc20406931cb1f62916e427500eb1716cc43a86165da
- MD5 38ae4ca1252804b46ac4c0dcba0ee480
- SHA1 99fce0f9e3f269729cbcdf52ced9195de98025b9
- SHA512 270a466a4e9317a6845241697d93b955ccec05e6c9be9328f1513996bfca0c2c6ebcd41fa9df9cbc504d059509f0aaf883eccbc6ffa2f5d6c543c183495de799
- SSDEEP 98304:rOx6LtE7HJTkgcQXxGO9JsbC2q642+Z2PdNpHtO03ucRA8eq2SBMQBSAhzEgUI4h:rEWt0JTkmXDuTrJCSN2CFA8elSBMQBWH
- TLSH T12736330EEFA754FDC41BC53852E7C931F4B274A04E31BF2E9150AD366D22D90A67862B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Executes dropped EXE 6 IoCs
pid Process 4860 google.exe 5436 gupdt.exe 4288 gupw.exe 5104 gupdt.exe 2316 gupdt.exe 2028 gupdt.exe - Power Settings 1 TTPs 36 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 6140 powercfg.exe 3808 powercfg.exe 1716 powercfg.exe 2716 powercfg.exe 5884 powercfg.exe 2540 powercfg.exe 4636 powercfg.exe 1832 powercfg.exe 2464 powercfg.exe 4400 powercfg.exe 2824 powercfg.exe 4224 powercfg.exe 2608 powercfg.exe 1724 powercfg.exe 3540 powercfg.exe 3812 powercfg.exe 5400 powercfg.exe 4924 powercfg.exe 2068 powercfg.exe 4936 powercfg.exe 1936 powercfg.exe 5100 powercfg.exe 6068 powercfg.exe 5564 powercfg.exe 2368 powercfg.exe 5308 powercfg.exe 2336 powercfg.exe 2972 powercfg.exe 5744 powercfg.exe 2880 powercfg.exe 6092 powercfg.exe 6076 powercfg.exe 4648 powercfg.exe 4600 powercfg.exe 3064 powercfg.exe 5156 powercfg.exe - Modifies data under HKEY_USERS 7 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wifinetworkmanager.dll,-4396 = "Passpoint Trusted Roots" certutil.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wsdapi.dll,-201 = "OEM eSIM Certification Authorities" certutil.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\CertCA.dll,-304 = "Endorsement Key Trusted Root Certification Authorities" certutil.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\CertCA.dll,-305 = "Endorsement Key Intermediate Certification Authorities" certutil.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wsdapi.dll,-200 = "Trusted Devices" certutil.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AppxPackaging.dll,-1001 = "Trusted Packaged App Installation Authorities" certutil.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SessEnv.dll,-101 = "Remote Desktop" certutil.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 3108 SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe 4860 google.exe 4860 google.exe 4860 google.exe 4860 google.exe 4860 google.exe 4860 google.exe 4860 google.exe 4860 google.exe 4860 google.exe 4860 google.exe 4860 google.exe 4860 google.exe 4860 google.exe 4860 google.exe 4860 google.exe 4860 google.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5400 powercfg.exe Token: SeCreatePagefilePrivilege 5400 powercfg.exe Token: SeShutdownPrivilege 3808 powercfg.exe Token: SeCreatePagefilePrivilege 3808 powercfg.exe Token: SeShutdownPrivilege 1716 powercfg.exe Token: SeCreatePagefilePrivilege 1716 powercfg.exe Token: SeShutdownPrivilege 2068 powercfg.exe Token: SeCreatePagefilePrivilege 2068 powercfg.exe Token: SeShutdownPrivilege 2716 powercfg.exe Token: SeCreatePagefilePrivilege 2716 powercfg.exe Token: SeShutdownPrivilege 4400 powercfg.exe Token: SeCreatePagefilePrivilege 4400 powercfg.exe Token: SeShutdownPrivilege 4648 powercfg.exe Token: SeCreatePagefilePrivilege 4648 powercfg.exe Token: SeShutdownPrivilege 5744 powercfg.exe Token: SeCreatePagefilePrivilege 5744 powercfg.exe Token: SeShutdownPrivilege 2824 powercfg.exe Token: SeCreatePagefilePrivilege 2824 powercfg.exe Token: SeShutdownPrivilege 6068 powercfg.exe Token: SeCreatePagefilePrivilege 6068 powercfg.exe Token: SeShutdownPrivilege 4936 powercfg.exe Token: SeCreatePagefilePrivilege 4936 powercfg.exe Token: SeShutdownPrivilege 5564 powercfg.exe Token: SeCreatePagefilePrivilege 5564 powercfg.exe Token: SeShutdownPrivilege 2336 powercfg.exe Token: SeCreatePagefilePrivilege 2336 powercfg.exe Token: SeShutdownPrivilege 4224 powercfg.exe Token: SeCreatePagefilePrivilege 4224 powercfg.exe Token: SeShutdownPrivilege 4600 powercfg.exe Token: SeCreatePagefilePrivilege 4600 powercfg.exe Token: SeShutdownPrivilege 2608 powercfg.exe Token: SeCreatePagefilePrivilege 2608 powercfg.exe Token: SeShutdownPrivilege 4924 powercfg.exe Token: SeCreatePagefilePrivilege 4924 powercfg.exe Token: SeShutdownPrivilege 3064 powercfg.exe Token: SeCreatePagefilePrivilege 3064 powercfg.exe Token: SeShutdownPrivilege 1724 powercfg.exe Token: SeCreatePagefilePrivilege 1724 powercfg.exe Token: SeShutdownPrivilege 5884 powercfg.exe Token: SeCreatePagefilePrivilege 5884 powercfg.exe Token: SeShutdownPrivilege 5156 powercfg.exe Token: SeCreatePagefilePrivilege 5156 powercfg.exe Token: SeShutdownPrivilege 1936 powercfg.exe Token: SeCreatePagefilePrivilege 1936 powercfg.exe Token: SeShutdownPrivilege 6140 powercfg.exe Token: SeCreatePagefilePrivilege 6140 powercfg.exe Token: SeShutdownPrivilege 2540 powercfg.exe Token: SeCreatePagefilePrivilege 2540 powercfg.exe Token: SeShutdownPrivilege 2368 powercfg.exe Token: SeCreatePagefilePrivilege 2368 powercfg.exe Token: SeShutdownPrivilege 4636 powercfg.exe Token: SeCreatePagefilePrivilege 4636 powercfg.exe Token: SeShutdownPrivilege 2880 powercfg.exe Token: SeCreatePagefilePrivilege 2880 powercfg.exe Token: SeShutdownPrivilege 1832 powercfg.exe Token: SeCreatePagefilePrivilege 1832 powercfg.exe Token: SeShutdownPrivilege 5308 powercfg.exe Token: SeCreatePagefilePrivilege 5308 powercfg.exe Token: SeShutdownPrivilege 6092 powercfg.exe Token: SeCreatePagefilePrivilege 6092 powercfg.exe Token: SeShutdownPrivilege 2972 powercfg.exe Token: SeCreatePagefilePrivilege 2972 powercfg.exe Token: SeShutdownPrivilege 3540 powercfg.exe Token: SeCreatePagefilePrivilege 3540 powercfg.exe - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4860 wrote to memory of 1868 4860 google.exe 91 PID 4860 wrote to memory of 5436 4860 google.exe 93 PID 4860 wrote to memory of 4288 4860 google.exe 94 PID 4860 wrote to memory of 5104 4860 google.exe 95 PID 4860 wrote to memory of 2316 4860 google.exe 96 PID 4288 wrote to memory of 5400 4288 gupw.exe 97 PID 4288 wrote to memory of 3808 4288 gupw.exe 99 PID 4860 wrote to memory of 2028 4860 google.exe 101 PID 4288 wrote to memory of 1716 4288 gupw.exe 102 PID 4288 wrote to memory of 2068 4288 gupw.exe 104 PID 4288 wrote to memory of 2716 4288 gupw.exe 106 PID 4288 wrote to memory of 4400 4288 gupw.exe 108 PID 4288 wrote to memory of 4648 4288 gupw.exe 110 PID 4288 wrote to memory of 5744 4288 gupw.exe 112 PID 4288 wrote to memory of 2824 4288 gupw.exe 114 PID 4288 wrote to memory of 6068 4288 gupw.exe 116 PID 4288 wrote to memory of 4936 4288 gupw.exe 118 PID 4288 wrote to memory of 5564 4288 gupw.exe 120 PID 4288 wrote to memory of 2336 4288 gupw.exe 122 PID 4288 wrote to memory of 4224 4288 gupw.exe 124 PID 4288 wrote to memory of 4600 4288 gupw.exe 126 PID 4288 wrote to memory of 2608 4288 gupw.exe 128 PID 4288 wrote to memory of 4924 4288 gupw.exe 130 PID 4288 wrote to memory of 3064 4288 gupw.exe 132 PID 4288 wrote to memory of 1724 4288 gupw.exe 134 PID 4288 wrote to memory of 5884 4288 gupw.exe 136 PID 4288 wrote to memory of 5156 4288 gupw.exe 138 PID 4288 wrote to memory of 1936 4288 gupw.exe 140 PID 4288 wrote to memory of 6140 4288 gupw.exe 142 PID 4288 wrote to memory of 2540 4288 gupw.exe 144 PID 4288 wrote to memory of 2368 4288 gupw.exe 146 PID 4288 wrote to memory of 4636 4288 gupw.exe 148 PID 4288 wrote to memory of 2880 4288 gupw.exe 150 PID 4288 wrote to memory of 1832 4288 gupw.exe 152 PID 4288 wrote to memory of 5308 4288 gupw.exe 154 PID 4288 wrote to memory of 6092 4288 gupw.exe 156 PID 4288 wrote to memory of 2972 4288 gupw.exe 158 PID 4288 wrote to memory of 3540 4288 gupw.exe 160 PID 4288 wrote to memory of 3812 4288 gupw.exe 162 PID 4288 wrote to memory of 2464 4288 gupw.exe 164 PID 4288 wrote to memory of 6076 4288 gupw.exe 166 PID 4288 wrote to memory of 5100 4288 gupw.exe 168 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen34.22534.8995.17333.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3108
-
C:\ProgramData\Google\Chrome\jtwj6qwzck\google.exeC:\ProgramData\Google\Chrome\jtwj6qwzck\google.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\system32\certutil.execertutil -addstore Root "C:\Windows\TEMP\gucert_tmp.cer"2⤵
- Modifies data under HKEY_USERS
PID:1868
-
-
C:\ProgramData\Google\Chrome\jtwj6qwzck\gupdt.exeC:\ProgramData\Google\Chrome\jtwj6qwzck\gupdt.exe2⤵
- Executes dropped EXE
PID:5436
-
-
C:\ProgramData\Google\Chrome\jtwj6qwzck\gupw.exeC:\ProgramData\Google\Chrome\jtwj6qwzck\gupw.exe /watch2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5400
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3808
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1716
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2068
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4400
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4648
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5744
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:6068
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4936
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5564
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2336
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4224
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4600
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4924
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3064
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1724
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5884
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5156
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:6140
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2540
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4636
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5308
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:6092
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3540
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 03⤵
- Power Settings
PID:3812
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 03⤵
- Power Settings
PID:2464
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 03⤵
- Power Settings
PID:6076
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 03⤵
- Power Settings
PID:5100
-
-
-
C:\ProgramData\Google\Chrome\jtwj6qwzck\gupdt.exeC:\ProgramData\Google\Chrome\jtwj6qwzck\gupdt.exe2⤵
- Executes dropped EXE
PID:5104
-
-
C:\ProgramData\Google\Chrome\jtwj6qwzck\gupdt.exeC:\ProgramData\Google\Chrome\jtwj6qwzck\gupdt.exe2⤵
- Executes dropped EXE
PID:2316
-
-
C:\ProgramData\Google\Chrome\jtwj6qwzck\gupdt.exeC:\ProgramData\Google\Chrome\jtwj6qwzck\gupdt.exe2⤵
- Executes dropped EXE
PID:2028
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Google\Chrome\jtwj6qwzck\google.dll
- Size 37KB
- SHA256 3990a66094ebef676eadab51e7d6423a10588d62bf9547b8a50977fd404fe212
- MD5 e8de4eb442c8163cc6101a5ec1bf45f2
- SHA1 f2561ad849fe5975cd7c2291b1321a72ffac45a2
- SHA512 f5341573d58ef653ad3ec9ecb3342a80e57ba646033f2bcc873b785c48a4a98ae619da42454daa1273d272eaf669fbc597ac5353883e7bd4ecba44a327ce2a1c
- SSDEEP 384:LGAXc80+8S5MO+KOGJomSKOwIrkTswNCGGMAS49:Ls5E+JlwIrQ2
- TLSH T12C0352C43ED55CD7ED24A23C61EAC2313A38F5E04A53475BE530A6320E13BE16EED686
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Google\Chrome\jtwj6qwzck\google.exe
- Size 4.9MB
- SHA256 6f21b609ec46ec04b046bc20406931cb1f62916e427500eb1716cc43a86165da
- MD5 38ae4ca1252804b46ac4c0dcba0ee480
- SHA1 99fce0f9e3f269729cbcdf52ced9195de98025b9
- SHA512 270a466a4e9317a6845241697d93b955ccec05e6c9be9328f1513996bfca0c2c6ebcd41fa9df9cbc504d059509f0aaf883eccbc6ffa2f5d6c543c183495de799
- SSDEEP 98304:rOx6LtE7HJTkgcQXxGO9JsbC2q642+Z2PdNpHtO03ucRA8eq2SBMQBSAhzEgUI4h:rEWt0JTkmXDuTrJCSN2CFA8elSBMQBWH
- TLSH T12736330EEFA754FDC41BC53852E7C931F4B274A04E31BF2E9150AD366D22D90A67862B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\TEMP\gucert_tmp.cer
- Size 757B
- SHA256 bdd10734898264a91be79de97292e3ad0e229775f927636539c19330e3b653be
- MD5 1e661a97ec63e62f4bfc7edb0dc86b04
- SHA1 4c6c9be66f1044d7a1234be999c005d54ce7049f
- SHA512 db7c3debd9c93e08ef30eec8add382f391a9cfe2c4e5581e49eaf593af48dbba7a0760d2642415acfccf59661a74a50586d11f88b9cf99327b968464f9729d2c
- TLSH T1F101416A2E3518167B0089003A59C31B2EB82B889AA26E67795100E1C9053A21EC5E38
- MD5 SHA1 SHA512 TLSH